{"id":"CVE-2023-46842","aliases":["ALPINE-CVE-2023-46842","DEBIAN-CVE-2023-46842","DSA-5836-1","EUVD-2023-51008","GHSA-hcr5-hp8w-36q9","SUSE-SU-2024:1259-1","SUSE-SU-2024:1295-1","SUSE-SU-2024:1540-1","SUSE-SU-2024:1541-1","SUSE-SU-2024:2531-1","SUSE-SU-2024:2535-1","SUSE-SU-2024:2654-1","UBUNTU-CVE-2023-46842","openSUSE-SU-2024:13853-1"],"status":"published","title":"x86 HVM hypercalls may trigger Xen bug check","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0853,"percentile":0.9512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2024-04-12T13:03:16Z","modified":"2026-10-26T18:02:34Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.16.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.16.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.17.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.18.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.17.5+23-ga4e5191dc0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.19.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.19.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.16.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.16.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.17.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"4.18.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.5+23-ga4e5191dc0-1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.5+23-ga4e5191dc0-1"}]}],"versions":["4.17.1+2-gb773c48e36-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1~deb12u1","4.17.2-1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1","4.17.3+10-g091466ba55-1.1~exp1","4.17.3+10-g091466ba55-1.1~exp2","4.17.3+10-g091466ba55-1~deb12u1","4.17.3+36-g54dacb5c02-1"],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.6_02-150400.4.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.6_02-150400.4.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.6_02-150400.4.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.6_02-150400.4.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_02-150500.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_02-150500.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_02-150500.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_02-150500.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6_14-150300.3.72.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6_14-150300.3.72.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_48-3.109.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_48-3.109.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.4_48-3.109.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2_06-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2_06-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2_06-150600.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5_12-150200.3.93.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5_12-150200.3.93.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.5_12-150200.3.93.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_04-150500.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_04-150500.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_04-150500.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_04-150500.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4_04-150500.3.33.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2","4.11.3+24-g14b62ab3e5-1ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.4+24-gddaaccbbab-1ubuntu2","4.16.0-1~ubuntu2","4.16.0-1~ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.2-1","4.17.2+55-g0b56bed864-1","4.17.2+76-ge1f9cb16e2-1","4.17.2+76-ge1f9cb16e2-1ubuntu1","4.17.3+10-g091466ba55-1","4.17.3+10-g091466ba55-1.1ubuntu2","4.17.3+10-g091466ba55-1.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0-1ubuntu1","4.20.0+68-g35cb38b222-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.2+7-g1badcf5035-2build2","4.20.2+37-g61ff35323e-1ubuntu1","4.20.3+127-gc42374a105-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.20.0+68-g35cb38b222-1","4.20.2+7-g1badcf5035-2","4.20.2+7-g1badcf5035-2build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.2_02-1.1"}]}],"bundled":3}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-454.html","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://xenbits.xen.org/xsa/advisory-454.html","tags":["Patch","Vendor Advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5OK6MH75S7YWD34EWW7QIZTS627RIE3/","tags":["Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYAZ7P6YFJ2E3FHKAGIKHWS46KYMMTZH/","tags":["Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46842"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5OK6MH75S7YWD34EWW7QIZTS627RIE3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYAZ7P6YFJ2E3FHKAGIKHWS46KYMMTZH"},{"url":"https://github.com/advisories/GHSA-hcr5-hp8w-36q9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-46842","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46842","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241259-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1221984","tags":["report"]},{"url":"https://bugzilla.suse.com/1222302","tags":["report"]},{"url":"https://bugzilla.suse.com/1222453","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31142","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241295-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241540-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241541-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242531-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214718","tags":["report"]},{"url":"https://bugzilla.suse.com/1225953","tags":["report"]},{"url":"https://bugzilla.suse.com/1227355","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31143","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242535-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214083","tags":["report"]},{"url":"https://bugzilla.suse.com/1221332","tags":["report"]},{"url":"https://bugzilla.suse.com/1221334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2193","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242654-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46842","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-454.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46842","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46842","title":"x86 HVM hypercalls may trigger Xen bug check","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.\n","status":"published","published":"2024-05-16T13:39:26.183Z","modified":"2025-11-04T17:12:51.532Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-51008","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.\n","status":"published","published":"2024-05-16T13:39:26Z","modified":"2025-11-04T17:12:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:28.381167Z"}],"ghsa":[{"id":"GHSA-hcr5-hp8w-36q9","title":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in...","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.","status":"published","published":"2024-05-16T15:31:37Z","modified":"2025-11-04T18:30:57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2023-46842","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.\n","status":"published","published":"2024-05-16T14:15:08.317Z","modified":"2026-06-17T06:31:44.613Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:09:15.329996Z"}],"osv":[{"id":"ALPINE-CVE-2023-46842","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.\n","status":"published","published":"2024-05-16T14:15:08.317Z","modified":"2026-10-26T17:17:58.650265055Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2023-46842","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and\nother modes.  This in particular means that they may set registers used\nto pass 32-bit-mode hypercall arguments to values outside of the range\n32-bit code would be able to set them to.\n\nWhen processing of hypercalls takes a considerable amount of time,\nthe hypervisor may choose to invoke a hypercall continuation.  Doing so\ninvolves putting (perhaps updated) hypercall arguments in respective\nregisters.  For guests not running in 64-bit mode this further involves\na certain amount of translation of the values.\n\nUnfortunately internal sanity checking of these translated values\nassumes high halves of registers to always be clear when invoking a\nhypercall.  When this is found not to be the case, it triggers a\nconsistency check in the hypervisor and causes a crash.\n","status":"published","published":"2024-05-16T14:15:08.317Z","modified":"2026-03-14T14:54:46.854035Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46842","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes.  This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to.  When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation.  Doing so involves putting (perhaps updated) hypercall arguments in respective registers.  For guests not running in 64-bit mode this further involves a certain amount of translation of the values.  Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall.  When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash.","status":"published","published":"2024-05-16T14:15:08.317Z","modified":"2026-10-26T18:02:34.599478752Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-46842","description":"Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes.  This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a considerable amount of time, the hypervisor may choose to invoke a hypercall continuation.  Doing so involves putting (perhaps updated) hypercall arguments in respective registers.  For guests not running in 64-bit mode this further involves a certain amount of translation of the values. Unfortunately internal sanity checking of these translated values assumes high halves of registers to always be clear when invoking a hypercall.  When this is found not to be the case, it triggers a consistency check in the hypervisor and causes a crash.","status":"published","published":"2024-05-16T14:15:00Z","modified":"2026-10-17T12:56:42.648262822Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"DSA-5836-1","title":"xen - security update","status":"published","published":"2024-12-26T00:00:00Z","modified":"2026-03-09T02:09:38.185872Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13853-1","title":"xen-4.18.2_02-1.1 on GA media","description":"These are all security issues fixed in the xen-4.18.2_02-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:43:36.6089Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1259-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2023-46842: Fixed denial of service due to Xen bug check triggered by HVM hypercalls (XSA-454) in xen x86 (bsc#1221984)\n- CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations (XSA-455) in xen x86 (bsc#1222302)\n- CVE-2024-2201: Fixed memory disclosure via Native Branch History Injection (XSA-456) in xen x86 (bsc#1222453)\n\nOther fixes:\n\n- Update to Xen 4.16.6 (bsc#1027519)\n","status":"published","published":"2024-04-12T13:03:16Z","modified":"2026-02-04T04:14:23.00613Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1295-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2023-46842: Fixed denial of service due to Xen bug check triggered by HVM hypercalls (XSA-454) in xen x86 (bsc#1221984)\n- CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations (XSA-455) in xen x86 (bsc#1222302)\n- CVE-2024-2201: Fixed memory disclosure via Native Branch History Injection (XSA-456) in xen x86 (bsc#1222453)\n\nOther fixes:\n\n- Update to Xen 4.17.4 (bsc#1027519)\n","status":"published","published":"2024-04-15T16:37:22Z","modified":"2026-02-04T02:40:52.799731Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1540-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2024-2201: Mitigation for Native Branch History Injection (XSA-456, bsc#1222453)\n- CVE-2023-46842: HVM hypercalls may trigger Xen bug check (XSA-454, bsc#1221984)\n- CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations (XSA-455, bsc#1222302)\n","status":"published","published":"2024-05-07T07:24:26Z","modified":"2026-02-04T02:54:32.960598Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1541-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2024-2201: Mitigation for Native Branch History Injection (XSA-456, bsc#1222453)\n- CVE-2023-46842: HVM hypercalls may trigger Xen bug check (XSA-454, bsc#1221984)\n- CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations (XSA-455, bsc#1222302)\n- Upstream bug fixes (bsc#1027519)\n","status":"published","published":"2024-05-07T07:24:34Z","modified":"2026-02-04T03:14:28.912724Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2531-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2023-46842: Fixed x86 HVM hypercalls may trigger Xen bug check (XSA-454, bsc#1221984).\n- CVE-2024-31143: Fixed double unlock in x86 guest IRQ handling (XSA-458, bsc#1227355).\n","status":"published","published":"2024-07-16T12:12:13Z","modified":"2026-02-04T04:24:46.330098Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2535-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2023-28746: Register File Data Sampling (XSA-452, bsc#1221332)\n- CVE-2023-46842: HVM hypercalls may trigger Xen bug check (XSA-454, bsc#1221984)\n- CVE-2024-2193: Fixed GhostRace, a speculative race conditions. (XSA-453, bsc#1221334)\n- CVE-2024-2201: Mitigation for Native Branch History Injection (XSA-456, bsc#1222453)\n- CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations (XSA-455, bsc#1222302)\n- CVE-2024-31143: Fixed double unlock in x86 guest IRQ handling (XSA-458, bsc#1227355)\n","status":"published","published":"2024-07-16T12:12:51Z","modified":"2026-02-04T02:21:25.636581Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2654-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2023-46842: Fixed x86 HVM hypercalls may trigger Xen bug check (XSA-454, bsc#1221984).\n- CVE-2024-31143: Fixed double unlock in x86 guest IRQ handling (XSA-458, bsc#1227355).\n","status":"published","published":"2024-07-30T13:33:35Z","modified":"2026-02-04T02:33:16.208589Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}